TOOOLS vulnerabilities
We track 6 vulnerabilities in TOOOLS products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2026.
Latest TOOOLS vulnerabilities
- 8.8 High severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the ex
- 8.8 High severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker
- 9.3 Critical severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attack
- 9.3 Critical severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulner
- 9.3 Critical severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL s
- 9.3 Critical severity
iSquad: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is